1792 requests/sec are too many from 32768 127.0.0.1,41617

Vernon Schryver vjs@calcite.rhyolite.com
Wed Jul 18 01:58:28 UTC 2007


> Sorry, I don't know why that got sent again.
>
> (Incidentally I was getting that message again, so I needed to restart DCC
> and sendmail....which apparently caused the resend)

> > What exactly would an error like this mean, or what would cause it?
> >
> > May 25 23:52:30 dakota dccd grey[176]: 1792 requests/sec are too many from
> > 32768 127.0.0.1,41617

Restarting dccd should have no effect on those messages, at least not for
the current version.

Unless sendmail is misconfigured with something like a loop, restarting
sendmail will have no effect.

The message means that `dccd -G on` is receiving a suspiciously high
rate of requests from the `dccm` (or dccifd or dccproc) process at
127.0.0.1 using DCC client-ID 32768.  If your sendmail+dccm installation
is really receiving more than 1700 mail messages per second, then add
an appropriate change to the RL_SUB value to GREY_DCCD_ARGS such as
    GREY_DCCD_ARGS="-R2000"
in /var/dcc/dcc_conf and restart the greylist server with 
    /var/dcc/libexec/rcDCC start
or perhaps
    /var/dcc/libexec/start-grey

The -R limits are intended to defend against (D)DoS attacks.
See the dccd man page, such as
http://www.dcc-servers.net/dcc/dcc-tree/dccd.html#OPTION-R


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.